// +union
message LimitResponse {
  // `type` is "Queue" or "Reject".
  // "Queue" means that requests that can not be executed upon arrival
  // are held in a queue until they can be executed or a queuing limit
  // is reached.
  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.
  // +unionDiscriminator

// +union
message LimitResponse {
  // `type` is "Queue" or "Reject".
  // "Queue" means that requests that can not be executed upon arrival
  // are held in a queue until they can be executed or a queuing limit
  // is reached.
  // "Reject" means that requests that can not be executed upon arrival
  // are rejected.
  // Required.
  // +unionDiscriminator

  //   2. If ALL matchConditions evaluate to TRUE, the policy is evaluated.
  //   3. If any matchCondition evaluates to an error (but none are FALSE):
  //      - If failurePolicy=Fail, reject the request
  //      - If failurePolicy=Ignore, the policy is skipped
  //
  // +patchMergeKey=name
  // +patchStrategy=merge
  // +listType=map
  // +listMapKey=name
  // +optional

  //
  // +optional
  // +listType=atomic
  repeated TokenRequest tokenRequests = 6;

  // requiresRepublish indicates the CSI driver wants `NodePublishVolume`
  // being periodically called to reflect any possible change in the mounted
  // volume. This field defaults to false.
  //
  // Note: After a successful initial NodePublishVolume call, subsequent calls

  // For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
  // with respect to the current state of the instance.
  // +optional
  // +kubebuilder:validation:Minimum=0
  optional int64 observedGeneration = 3;

  optional int32 readyReplicas = 4;

  // The number of available replicas (ready for at least minReadySeconds) for this replica set.
  // +optional
  optional int32 availableReplicas = 5;

  // ObservedGeneration reflects the generation of the most recently observed ReplicaSet.
  // +optional
  optional int64 observedGeneration = 3;

  // Represents the latest available observations of a replica set's current state.
  // +optional

  optional int32 readyReplicas = 4;

  // The number of available replicas (ready for at least minReadySeconds) for this replica set.
  // +optional
  optional int32 availableReplicas = 5;

  // ObservedGeneration reflects the generation of the most recently observed ReplicaSet.
  // +optional
  optional int64 observedGeneration = 3;

  // Represents the latest available observations of a replica set's current state.
  // +optional

  // +optional
  optional string value = 3;

  // Effect indicates the taint effect to match. Empty means match all taint effects.
  // When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
  // +optional
  optional string effect = 4;

  // TolerationSeconds represents the period of time the toleration (which must be
  // of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,

  //
  // The data must consist only of PEM certificate blocks that parse as valid
  // X.509 certificates.  Each certificate must include a basic constraints
  // extension with the CA bit set.  The API server will reject objects that
  // contain duplicate certificates, or that use PEM block headers.
  //
  // Users of ClusterTrustBundles, including Kubelet, are free to reorder and

message TokenRequestSpec {
  // Audiences are the intendend audiences of the token. A recipient of a
  // token must identify themself with an identifier in the list of
  // audiences of the token, and otherwise should reject the token. A
  // token issued for multiple audiences may be used to authenticate
  // against any of the audiences listed but implies a high degree of
  // trust between the target audiences.
  repeated string audiences = 1;